GRC Analyst

About the role

Vercel is seeking a GRC Analyst to join our Governance, Risk and Compliance team to oversee our security and privacy frameworks. You will manage compliance standards including SOC 2, ISO 27001, HIPAA, and PCI DSS while fostering a culture of accountability across the organization. This role reports directly to the Head of GRC.

Key facts

What you'll do

• Partner with internal teams to maintain effective controls and drive remediation tasks to completion.
• Manage the annual audit lifecycle, including tracking deliverables and coordinating documentation.
• Improve evidence management practices and identify opportunities to automate GRC operations.
• Support go-to-market efforts by completing security questionnaires and addressing customer compliance inquiries.
• Develop and lead internal training programs to increase awareness of regulatory and ethical requirements.
• Build cross-functional relationships to ensure compliance responsibilities are understood and met.

Requirements

• Minimum of 3 years of experience managing audit lifecycles for frameworks like SOC 2, ISO 27001, PCI, or HIPAA in cloud environments.
• Proven ability to integrate technical controls and policies into the software development lifecycle.
• Strong project management skills with the ability to lead initiatives across multiple business units.
• Ability to work effectively in a fast-paced, high-growth startup environment.

Nice to have

• Proficiency with cloud infrastructure platforms such as AWS or Azure.
• Familiarity with tools like Drata, Linear, or Datadog.
• Background in frontend development or open source software.
• Professional certifications such as CISM, CISSP, or CCEP.

Skills & tools

• Compliance frameworks: SOC 2, ISO 27001, HIPAA, PCI DSS
• Cloud infrastructure: AWS, Azure
• GRC and development tooling: Drata, Linear, Datadog

Practical notes

• Compensation: The base salary range for San Francisco is $134,000 to $202,000, adjusted based on location, skills, and experience.
• Benefits: Includes equity, healthcare, flexible time off, equipment, and a work-from-home stipend.
• Office policy: If you reside within commuting distance of our offices in SF, NY, London, or Berlin, you are expected to work on-site on Mondays, Tuesdays, and Fridays.
• Application note: We encourage you to apply even if you do not meet every requirement listed, provided you can contribute value to our team.